Improper Output Neutralization for Logs vulnerability in Apache Log4cxx affects versions before 1.5.0. When using JSONLayout, certain non-printable characters in attacker-supplied messages are not properly escaped, potentially leading to misinterpretation of log information by applications. Users are advised to upgrade to version 1.5.0 to resolve this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2025-54813 |
Exploitation
An attacker can exploit this vulnerability by sending a specially crafted message containing non-printable characters to an application that uses Apache Log4cxx with JSONLayout. If the application logs this message, the non-printable characters will be included in the JSON output, potentially leading to log misinterpretation by other systems that consume these logs.
Affected Products
- Apache Log4cxx versions before 1.5.0: This version is vulnerable to improper output neutralization, which can lead to log misinterpretation.
Mitigation
To mitigate this vulnerability, users should upgrade to Apache Log4cxx version 1.5.0 or later, which addresses the improper output neutralization issue and ensures that all payload bytes are properly escaped.